Use node:20-slim for Docker (#849)

* Use node:20-slim

* Add curl

* Lint

* retrigger

* Update stale cargo deps

* Update axios

* Add pkg-config and remove stale comment

* changelog

* Add openssl dep

* Add libssl-dev

Dockerfile

@@ -1,9 +1,11 @@
 # Stage 0: Build the thing
 # Need debian based image to build the native rust module
 # as musl doesn't support cdylib
-FROM node:18 AS builder
+FROM node:20-slim AS builder
+
+# Needed in order to build rust FFI bindings.
+RUN apt-get update && apt-get install -y build-essential cmake curl pkg-config pkg-config libssl-dev
 
-# We need rustup so we have a sensible rust version, the version packed with bullsye is too old
 RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal
 ENV PATH="/root/.cargo/bin:${PATH}"
 
@@ -12,9 +14,6 @@ ENV PATH="/root/.cargo/bin:${PATH}"
 ARG CARGO_NET_GIT_FETCH_WITH_CLI=false
 ENV CARGO_NET_GIT_FETCH_WITH_CLI=$CARGO_NET_GIT_FETCH_WITH_CLI
 
-# Needed to build rust things for matrix-sdk-crypto-nodejs
-# See https://github.com/matrix-org/matrix-rust-sdk-bindings/blob/main/crates/matrix-sdk-crypto-nodejs/release/Dockerfile.linux#L5-L6
-RUN apt-get update && apt-get install -y build-essential cmake
 
 WORKDIR /src
 
@@ -30,10 +29,12 @@ RUN yarn build
 
 
 # Stage 1: The actual container
-FROM node:18
+FROM node:20-slim
 
 WORKDIR /bin/matrix-hookshot
 
+RUN apt-get update && apt-get install -y openssl ca-certificates
+
 COPY --from=builder /src/yarn.lock /src/package.json ./
 COPY --from=builder /cache/yarn /cache/yarn
 RUN yarn config set yarn-offline-mirror /cache/yarn

changelog.d/849.misc

@@ -0,0 +1 @@
+Use Node 20 (slim) for Docker image base.

package.json

@@ -48,7 +48,7 @@
     "@octokit/webhooks": "^9.1.2",
     "@sentry/node": "^7.52.1",
     "ajv": "^8.11.0",
-    "axios": "^0.24.0",
+    "axios": "^1.6.2",
     "cors": "^2.8.5",
     "express": "^4.17.3",
     "figma-js": "^1.14.0",

src/Connections/GithubRepo.ts

@@ -862,7 +862,7 @@ export class GitHubRepoConnection extends CommandConnection<GitHubRepoConnection
                 inputs: workflowArgs,
             });
         } catch (ex) {
-            const httpError = ex as AxiosError;
+            const httpError = ex as AxiosError<{message: string}>;
             if (httpError.response?.data) {
                 throw new CommandError(httpError.response?.data.message, httpError.response?.data.message);
             }

src/figma/index.ts

@@ -32,7 +32,7 @@ export async function ensureFigmaWebhooks(figmaConfig: BridgeConfigFigma, matrix
         try {
             await client.me();
         } catch (ex) {
-            const axiosErr = ex as AxiosError;
+            const axiosErr = ex as AxiosError<{message: string}>;
             if (axiosErr.isAxiosError) {
                 log.error(`Failed to check figma access token: ${axiosErr.code} ${axiosErr.response?.data?.message ?? ""}`)
             }
@@ -46,7 +46,7 @@ export async function ensureFigmaWebhooks(figmaConfig: BridgeConfigFigma, matrix
                 webhookDefinition = (await client.client.get(`webhooks/${webhookId}`, axiosConfig)).data;
                 log.info(`Found existing hook for Figma instance ${instanceName} ${webhookId}`);
             } catch (ex) {
-                const axiosErr = ex as AxiosError;
+                const axiosErr = ex as AxiosError<{message: string}>;
                 if (axiosErr.response?.status !== 404) {
                     // Missing webhook, probably not found.
                     if (axiosErr.isAxiosError) {
@@ -66,7 +66,7 @@ export async function ensureFigmaWebhooks(figmaConfig: BridgeConfigFigma, matrix
                         endpoint: publicUrl,
                     }, axiosConfig);
                 } catch (ex) {
-                    const axiosErr = ex as AxiosError;
+                    const axiosErr = ex as AxiosError<{message: string}>;
                     if (axiosErr.isAxiosError) {
                         log.error(`Failed to update webhook: ${axiosErr.code} ${axiosErr.response?.data?.message ?? ""}`)
                     }
@@ -86,7 +86,7 @@ export async function ensureFigmaWebhooks(figmaConfig: BridgeConfigFigma, matrix
                 webhookDefinition = res.data as FigmaWebhookDefinition;
                 await matrixClient.setAccountData(accountDataKey, {webhookId: webhookDefinition.id});
             } catch (ex) {
-                const axiosErr = ex as AxiosError;
+                const axiosErr = ex as AxiosError<{message: string}>;
                 if (axiosErr.isAxiosError) {
                     log.error(`Failed to create webhook: ${axiosErr.code} ${axiosErr.response?.data?.message ?? ""}`)
                 }

yarn.lock

@@ -1999,13 +1999,6 @@ axios@^0.21.1:
   dependencies:
     follow-redirects "^1.14.0"
 
-axios@^0.24.0:
-  version "0.24.0"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-0.24.0.tgz#804e6fa1e4b9c5288501dd9dff56a7a0940d20d6"
-  integrity sha512-Q6cWsys88HoPgAaFAVUb0WpPk0O8iTeisR9IMqy9G8AbO4NlpVknrnQS03zzF9PGAWgO3cgletO3VjV/P7VztA==
-  dependencies:
-    follow-redirects "^1.14.4"
-
 axios@^0.27.2:
   version "0.27.2"
   resolved "https://registry.yarnpkg.com/axios/-/axios-0.27.2.tgz#207658cc8621606e586c85db4b41a750e756d972"
@@ -2014,6 +2007,15 @@ axios@^0.27.2:
     follow-redirects "^1.14.9"
     form-data "^4.0.0"
 
+axios@^1.6.2:
+  version "1.6.2"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.6.2.tgz#de67d42c755b571d3e698df1b6504cde9b0ee9f2"
+  integrity sha512-7i24Ri4pmDRfJTR7LDBhsOTtcm+9kjX5WiY1X3wIisx6G9So3pfMkEiU7emUBe46oceVImccTEM3k6C5dbVW8A==
+  dependencies:
+    follow-redirects "^1.15.0"
+    form-data "^4.0.0"
+    proxy-from-env "^1.1.0"
+
 babel-plugin-transform-hook-names@^1.0.2:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/babel-plugin-transform-hook-names/-/babel-plugin-transform-hook-names-1.0.2.tgz#0d75c2d78e8bbcdb258241131562b9cf07f010f3"
@@ -3372,6 +3374,11 @@ follow-redirects@^1.14.9:
   resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.1.tgz#0ca6a452306c9b276e4d3127483e29575e207ad5"
   integrity sha512-yLAMQs+k0b2m7cVxpS1VKJVvoz7SS9Td1zss3XRwXj+ZDH00RJgnuLx7E44wx02kQLrdM3aOOy+FpzS7+8OizA==
 
+follow-redirects@^1.15.0:
+  version "1.15.3"
+  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.3.tgz#fe2f3ef2690afce7e82ed0b44db08165b207123a"
+  integrity sha512-1VzOtuEM8pC9SFU1E+8KfTjZyMztRsgEfwQl44z8A25uy13jSzTj6dyK2Df52iV0vgHCfBwLhDWevLn95w5v6Q==
+
 foreground-child@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/foreground-child/-/foreground-child-2.0.0.tgz#71b32800c9f15aa8f2f83f4a6bd9bff35d861a53"
@@ -5241,6 +5248,11 @@ proxy-addr@~2.0.7:
     forwarded "0.2.0"
     ipaddr.js "1.9.1"
 
+proxy-from-env@^1.1.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/proxy-from-env/-/proxy-from-env-1.1.0.tgz#e102f16ca355424865755d2c9e8ea4f24d58c3e2"
+  integrity sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==
+
 psl@^1.1.28:
   version "1.8.0"
   resolved "https://registry.yarnpkg.com/psl/-/psl-1.8.0.tgz#9326f8bcfb013adcc005fdff056acce020e51c24"